npm - veryfront - Versions diffs - 0.1.121 → 0.1.124 - Mend

veryfront 0.1.121 → 0.1.124

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/esm/deno.js CHANGED Viewed

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.121",
+    "version": "0.1.124",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/security/http/response/security-handler.js CHANGED Viewed

@@ -12,8 +12,8 @@ export function generateNonce() {
 /**
  * Build a default CSP that works for typical veryfront apps.
  *
- * - Scripts: nonce-based + cdn.jsdelivr.net (Scalar API docs, html2canvas,
- *   React UMD, browser inference)
+ * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
+ *   html2canvas, legacy/browser ESM hydration)
  * - Styles: 'self' + 'unsafe-inline' + nonce + Google Fonts + cdn.veryfront.com
  *   plus style-src-attr 'unsafe-inline' so React style="" attributes remain
  *   compatible while inline <style> tags continue to use the nonce
@@ -28,7 +28,7 @@ export function generateNonce() {
 function buildDefaultCSP(nonce) {
     return [
         `default-src 'self'`,
-        `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net`,
+        `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
         `style-src 'self' 'unsafe-inline' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
         `style-src-attr 'unsafe-inline'`,
         `img-src 'self' data: https:`,

package/esm/src/server/context/request-context.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;~~AAIlD~~,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,SAAS,GAAG,YAAY,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,cAAc,~~CA+BzE~~;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,cAAc,CAAC,EAAE,OAAO,GACvB,MAAM,GAAG,YAAY,GAAG,WAAW,CAIrC;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAExF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAG/F"}
1	+ {"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAKlD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,SAAS,GAAG,YAAY,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,cAAc,CAqBzE;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,cAAc,CAAC,EAAE,OAAO,GACvB,MAAM,GAAG,YAAY,GAAG,WAAW,CAIrC;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAExF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAG/F"}

package/esm/src/server/context/request-context.js CHANGED Viewed

@@ -1,16 +1,8 @@
 import { getHostEnv } from "../../platform/compat/process.js";
 import { parseProjectDomain } from "../utils/domain-parser.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 export function createRequestContext(req) {
-    const { hostname } = new URL(req.url);
-    const rawForwardedHost = req.headers.get("x-forwarded-host");
-    // x-forwarded-host can be comma-separated (multiple proxies); take the first entry.
-    const forwardedHost = rawForwardedHost
-        ? (rawForwardedHost.split(",")[0]?.trim() || undefined)
-        : undefined;
-    const hostHeader = req.headers.get("host");
-    // In proxy mode, req.url hostname may be 127.0.0.1 while the real domain
-    // is in the Host header (e.g., "flow-ops.lvh.me:3010"). Prefer Host header.
-    const effectiveHost = forwardedHost ?? hostHeader ?? hostname;
+    const effectiveHost = getEffectiveRequestHost(req);
     const parsed = parseProjectDomain(effectiveHost);
     const headerProjectSlug = req.headers.get("x-project-slug")?.trim() || undefined;
     const xEnvironment = req.headers.get("x-environment");

package/esm/src/server/handlers/dev/projects/api.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/projects/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;~~AAWrD~~,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAOpG"}
1	+ {"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/projects/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAYrD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAOpG"}

package/esm/src/server/handlers/dev/projects/api.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
+import { getEffectiveRequestHost } from "../../../utils/request-host.js";
 const JSON_HEADERS = {
     "Content-Type": "application/json",
     "Cache-Control": "no-cache",
@@ -16,10 +17,7 @@ export function handleProjectsAPI(req, ctx) {
 }
 function handleGetConfig(req, ctx) {
     const url = new URL(req.url);
-    const host = req.headers.get("x-forwarded-host") ??
-        req.headers.get("host") ??
-        url.host ??
-        "lvh.me";
+    const host = getEffectiveRequestHost(req, url) || "lvh.me";
     const hostWithoutPort = host.replace(/:\d+$/, "") || "lvh.me";
     const port = host.includes(":") ? host.split(":")[1] ?? "" : "";
     return jsonResponse({

package/esm/src/server/handlers/preview/hmr.handler.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AASrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;~~AAmBrB~~,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCzB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0JzE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;IAcvB,OAAO,CAAC,MAAM,CAAC,cAAc;CAO9B"}
1	+ {"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AASrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAoBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCzB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0JzE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;IAcvB,OAAO,CAAC,MAAM,CAAC,cAAc;CAO9B"}

package/esm/src/server/handlers/preview/hmr.handler.js CHANGED Viewed

@@ -10,6 +10,7 @@ import { isLocalDevHost } from "../../utils/domain-parser.js";
 import { addClient, clearAll, getClient, getClientCount, getClientDetails, removeClient, } from "./hmr-client-manager.js";
 import { getPingIntervalMs, startPingInterval, stopPingInterval } from "./hmr-ping-keepalive.js";
 import { broadcastUpdate, getMetrics } from "./hmr-message-router.js";
+import { getEffectiveRequestHost } from "../../utils/request-host.js";
 const logger = serverLogger.component("hmr-handler");
 // Priority between auth (0) and high (100)
 const PRIORITY_HMR = HandlerPriority.EARLY;
@@ -62,7 +63,7 @@ export class HMRHandler extends BaseHandler {
         const queryEnv = url.searchParams.get("x-environment");
         const isPreviewMode = ctx.requestContext?.mode === "preview" || queryEnv === "preview";
         const isLocal = !!ctx.isLocalProject;
-        const host = req.headers.get("host") ?? "";
+        const host = getEffectiveRequestHost(req, url);
         const isLocalhost = isLocalDevHost(host);
         if (!isPreviewMode && !isLocal && !isLocalhost) {
             logger.warn("Skipping /_ws - not preview, local dev, or localhost", {

package/esm/src/server/runtime-handler/project-resolution.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"project-resolution.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAIlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;~~AAQtF~~;;GAEG;AACH,UAAU,qBAAqB;IAC7B,qBAAqB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACrD,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAE7E;AAUD,UAAU,cAAc;IACtB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,sCAAsC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,wDAAwD;IACxD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;~~AAeD~~;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,cAAc,CAkBpF;AAED,UAAU,uBAAuB;IAC/B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,QAAQ,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,gCAAgC;IAChC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,UAAU,wBAAwB;IAChC,sCAAsC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,gDAAgD;IAChD,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;QAC3C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAClC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;IACF,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,wCAAwC;IACxC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAuHlC;AAGD,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}
1	+ {"version":3,"file":"project-resolution.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAIlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAStF;;GAEG;AACH,UAAU,qBAAqB;IAC7B,qBAAqB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACrD,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAE7E;AAUD,UAAU,cAAc;IACtB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,sCAAsC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,wDAAwD;IACxD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAMD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,cAAc,CAkBpF;AAED,UAAU,uBAAuB;IAC/B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,QAAQ,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,gCAAgC;IAChC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,UAAU,wBAAwB;IAChC,sCAAsC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,gDAAgD;IAChD,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;QAC3C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAClC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;IACF,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,wCAAwC;IACxC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAuHlC;AAGD,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}

package/esm/src/server/runtime-handler/project-resolution.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { getEnvironmentType, lookupProjectByDomain } from "../utils/domain-looku
 import { parseProxyEnvironment } from "./proxy-environment.js";
 import { SpanNames, withSpan } from "./tracing.js";
 import { isInternalHost } from "./request-utils.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 const baseLogger = getBaseLogger("SERVER");
 const logger = baseLogger.component("project-resolution");
 let injectedDeps = null;
@@ -20,17 +21,8 @@ function getDeps() {
         getEnvironmentType: injectedDeps?.getEnvironmentType ?? getEnvironmentType,
     };
 }
-function parseForwardedHost(raw) {
-    if (!raw)
-        return undefined;
-    // x-forwarded-host can be a comma-separated list when multiple proxies
-    // are chained. Take the first (client-facing) entry and trim whitespace.
-    const first = raw.split(",")[0]?.trim();
-    return first || undefined;
-}
 function getEffectiveHost(req, url) {
-    const forwardedHost = parseForwardedHost(req.headers.get("x-forwarded-host"));
-    return forwardedHost ?? req.headers.get("host") ?? url.host;
+    return getEffectiveRequestHost(req, url);
 }
 /**
  * Extract project-related headers from a request.

package/esm/src/server/utils/request-host.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+import * as dntShim from "../../../_dnt.shims.js";
+export declare function parseForwardedHost(raw: string | null): string | undefined;
+export declare function getEffectiveRequestHost(req: dntShim.Request, url?: URL): string;
+//# sourceMappingURL=request-host.d.ts.map

package/esm/src/server/utils/request-host.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"request-host.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/request-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAI/E"}

package/esm/src/server/utils/request-host.js ADDED Viewed

@@ -0,0 +1,11 @@
+export function parseForwardedHost(raw) {
+    if (!raw)
+        return undefined;
+    const first = raw.split(",")[0]?.trim();
+    return first || undefined;
+}
+export function getEffectiveRequestHost(req, url) {
+    return parseForwardedHost(req.headers.get("x-forwarded-host")) ??
+        req.headers.get("host") ??
+        (url ?? new URL(req.url)).host;
+}

package/esm/src/utils/version-constant.d.ts CHANGED Viewed

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.121";
+export declare const VERSION = "0.1.124";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js CHANGED Viewed

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.121";
+export const VERSION = "0.1.124";

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.121",
+  "version": "0.1.124",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js CHANGED Viewed

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.121",
+  "version": "0.1.124",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/security/http/response/security-handler.ts CHANGED Viewed

@@ -18,8 +18,8 @@ export function generateNonce(): string {
 /**
  * Build a default CSP that works for typical veryfront apps.
  *
- * - Scripts: nonce-based + cdn.jsdelivr.net (Scalar API docs, html2canvas,
- *   React UMD, browser inference)
+ * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
+ *   html2canvas, legacy/browser ESM hydration)
  * - Styles: 'self' + 'unsafe-inline' + nonce + Google Fonts + cdn.veryfront.com
  *   plus style-src-attr 'unsafe-inline' so React style="" attributes remain
  *   compatible while inline <style> tags continue to use the nonce
@@ -34,7 +34,7 @@ export function generateNonce(): string {
 function buildDefaultCSP(nonce: string): string {
   return [
     `default-src 'self'`,
-    `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net`,
+    `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
     `style-src 'self' 'unsafe-inline' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
     `style-src-attr 'unsafe-inline'`,
     `img-src 'self' data: https:`,

package/src/src/server/context/request-context.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { getHostEnv } from "../../platform/compat/process.js";
 import { parseProjectDomain } from "../utils/domain-parser.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 export interface RequestContext {
   token: string;
@@ -10,17 +11,7 @@ export interface RequestContext {
 }
 export function createRequestContext(req: dntShim.Request): RequestContext {
-  const { hostname } = new URL(req.url);
-  const rawForwardedHost = req.headers.get("x-forwarded-host");
-  // x-forwarded-host can be comma-separated (multiple proxies); take the first entry.
-  const forwardedHost = rawForwardedHost
-    ? (rawForwardedHost.split(",")[0]?.trim() || undefined)
-    : undefined;
-  const hostHeader = req.headers.get("host");
-  // In proxy mode, req.url hostname may be 127.0.0.1 while the real domain
-  // is in the Host header (e.g., "flow-ops.lvh.me:3010"). Prefer Host header.
-  const effectiveHost = forwardedHost ?? hostHeader ?? hostname;
+  const effectiveHost = getEffectiveRequestHost(req);
   const parsed = parseProjectDomain(effectiveHost);
   const headerProjectSlug = req.headers.get("x-project-slug")?.trim() || undefined;

package/src/src/server/handlers/dev/projects/api.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
 import type { HandlerContext } from "../../types.js";
+import { getEffectiveRequestHost } from "../../../utils/request-host.js";
 const JSON_HEADERS = {
   "Content-Type": "application/json",
@@ -21,11 +22,7 @@ export function handleProjectsAPI(req: dntShim.Request, ctx: HandlerContext): dn
 function handleGetConfig(req: dntShim.Request, ctx: HandlerContext): dntShim.Response {
   const url = new URL(req.url);
-  const host = req.headers.get("x-forwarded-host") ??
-    req.headers.get("host") ??
-    url.host ??
-    "lvh.me";
+  const host = getEffectiveRequestHost(req, url) || "lvh.me";
   const hostWithoutPort = host.replace(/:\d+$/, "") || "lvh.me";
   const port = host.includes(":") ? host.split(":")[1] ?? "" : "";

package/src/src/server/handlers/preview/hmr.handler.ts CHANGED Viewed

@@ -28,6 +28,7 @@ import {
 } from "./hmr-client-manager.js";
 import { getPingIntervalMs, startPingInterval, stopPingInterval } from "./hmr-ping-keepalive.js";
 import { broadcastUpdate, getMetrics } from "./hmr-message-router.js";
+import { getEffectiveRequestHost } from "../../utils/request-host.js";
 const logger = serverLogger.component("hmr-handler");
@@ -95,7 +96,7 @@ export class HMRHandler extends BaseHandler {
     const queryEnv = url.searchParams.get("x-environment");
     const isPreviewMode = ctx.requestContext?.mode === "preview" || queryEnv === "preview";
     const isLocal = !!ctx.isLocalProject;
-    const host = req.headers.get("host") ?? "";
+    const host = getEffectiveRequestHost(req, url);
     const isLocalhost = isLocalDevHost(host);
     if (!isPreviewMode && !isLocal && !isLocalhost) {

package/src/src/server/runtime-handler/project-resolution.ts CHANGED Viewed

@@ -19,6 +19,7 @@ import { getEnvironmentType, lookupProjectByDomain } from "../utils/domain-looku
 import { parseProxyEnvironment, type ProxyEnvironment } from "./proxy-environment.js";
 import { SpanNames, withSpan } from "./tracing.js";
 import { isInternalHost } from "./request-utils.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 const baseLogger = getBaseLogger("SERVER");
@@ -73,17 +74,8 @@ interface RequestHeaders {
   projectPath: string | undefined;
 }
-function parseForwardedHost(raw: string | null): string | undefined {
-  if (!raw) return undefined;
-  // x-forwarded-host can be a comma-separated list when multiple proxies
-  // are chained. Take the first (client-facing) entry and trim whitespace.
-  const first = raw.split(",")[0]?.trim();
-  return first || undefined;
-}
 function getEffectiveHost(req: dntShim.Request, url: URL): string {
-  const forwardedHost = parseForwardedHost(req.headers.get("x-forwarded-host"));
-  return forwardedHost ?? req.headers.get("host") ?? url.host;
+  return getEffectiveRequestHost(req, url);
 }
 /**

package/src/src/server/utils/request-host.ts ADDED Viewed

@@ -0,0 +1,13 @@
+import * as dntShim from "../../../_dnt.shims.js";
+export function parseForwardedHost(raw: string | null): string | undefined {
+  if (!raw) return undefined;
+  const first = raw.split(",")[0]?.trim();
+  return first || undefined;
+}
+export function getEffectiveRequestHost(req: dntShim.Request, url?: URL): string {
+  return parseForwardedHost(req.headers.get("x-forwarded-host")) ??
+    req.headers.get("host") ??
+    (url ?? new URL(req.url)).host;
+}

package/src/src/utils/version-constant.ts CHANGED Viewed

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.121";
+export const VERSION = "0.1.124";